This invention relates generally to fault-tolerant circuits and, more particularly, to output circuits associated with fault-tolerant computers and industrial controllers. The concept of using multiple computational devices to maintain the integrity of a computer-controlled process has been known for some years. The computational devices perform each function separately and the results are compared to determine the "correct" one. A commonly employed configuration has three computational devices and the results are compared in a voting circuit, such that the best two of the three results is taken to be correct. When one of the three computational devices generates erroneous results, it is usually replaced promptly, to avoid the possibility of having two malfunctioning computational devices in operation at the same time. This voting concept may be applied to practically all operations performed by the computational devices, including accessing data storage locations and performing arithmetic or logical computations.
A different, but related problem is the design of output circuits to have a similar type of multiple redundancy. There are two basic types of output from computational devices used as industrial controllers. One type of output consists of "on" and "off" signals and is usually referred to as digital or binary. The other form of output is in the form of an analog signal, which might be used to control, for example, the position of a valve. The valve, in turn, can control a fluid flow rate, a pressure level, or some other physical parameter. Digital output signals are used in control processes to turn direct-current (dc) motors on and off, to open and close solenoid-actuated valves, and to perform various other functions.
One approach to providing the output signals is to connect multiple outputs, from the multiple computational devices, to a voting circuit and then to connect the output of the voting circuit to the control terminal of a dc switch connected between a power supply and a load, such as a motor. The difficulty is that both the voting circuit and the switch are single components subject to failure. A failure of either of these components would probably result in the generation of an erroneous signal, in spite of the presence of multiple computational devices. The same considerations apply to the analog case. One could connect the digital outputs of three computational devices to a single voting circuit supplying a single digital-to-analog converter. Again, failure of either the voting circuit or the converter would probably result in the generation of an erroneous output signal.
From the foregoing, it will be apparent that there is still a need for a configuration of output circuits that is more fault tolerant, in the same sense that the computational devices themselves are rendered fault tolerant by their multiple redundancy. The present invention is directed to this end.